Kubernetes Role With Pod Exec Permissions Created

Description

This detection monitors for Roles or ClusterRoles being created that grant permissions to exec into pods. The pods/exec subresource allows executing arbitrary commands inside containers, which can be abused for lateral movement, credential theft, or container escape. Attackers who gain RBAC modification permissions often create roles with pods/exec to establish backdoor access for executing commands across the cluster.

Query · python

from panther_kubernetes_helpers import is_failed_request, is_system_principal, k8s_alert_context


def rule(event):
    verb = event.udm("verb")
    resource = event.udm("resource")
    username = event.udm("username")
    response_status = event.udm("responseStatus")

    # Only check Role/ClusterRole creation events
    if verb != "create" or resource not in {"roles", "clusterroles"}:
        return False

    # Skip failed requests
    if is_failed_request(response_status):
        return False

    # Exclude system principals to reduce false positives from legitimate operators
    if is_system_principal(username):
        return False

    # Check if role grants pods/exec permissions
    request_object = event.udm("requestObject") or {}
    rules = request_object.get("rules") or []

    for rule_entry in rules:
        resources = rule_entry.get("resources") or []
        # Check for pods/exec subresource
        if "pods/exec" in resources:
            return True

    return False


def title(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    resource = event.udm("resource") or "<UNKNOWN_RESOURCE>"
    name = event.udm("name") or "<UNKNOWN_ROLE>"
    namespace = event.udm("namespace") or "<CLUSTER_SCOPED>"

    role_type = "ClusterRole" if resource == "clusterroles" else "Role"

    if namespace != "<CLUSTER_SCOPED>":
        return f"[{username}] created {role_type} [{namespace}/{name}] with pods/exec permissions"

    return f"[{username}] created {role_type} [{name}] with pods/exec permissions "


def dedup(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    resource = event.udm("resource") or "<UNKNOWN_RESOURCE>"
    name = event.udm("name") or "<UNKNOWN_ROLE>"
    return f"k8s_role_podexec_{username}_{resource}_{name}"


def severity(event):
    """ClusterRoles are more dangerous than namespaced Roles."""
    resource = event.udm("resource") or ""

    # Critical for ClusterRole (cluster-wide exec permissions)
    if resource == "clusterroles":
        return "CRITICAL"

    # High for namespaced Role (namespace-scoped exec permissions)
    return "HIGH"


def alert_context(event):
    request_object = event.udm("requestObject") or {}
    rules = request_object.get("rules") or []

    # Extract only the rules that grant pods/exec
    exec_rules = []
    for rule_entry in rules:
        if "pods/exec" in (rule_entry.get("resources") or []):
            exec_rules.append(rule_entry)

    return k8s_alert_context(
        event,
        extra_fields={
            "role_name": event.udm("name"),
            "role_type": event.udm("resource"),
            "exec_rules": exec_rules,
        },
    )

Analyst notes

Review the role rules to identify what verbs and API groups were granted alongside pods/exec and determine if this role creation is expected
Identify all API operations by the creating user in the 2 hours before and after the alert and search for any RoleBindings or ClusterRoleBindings that reference this role
Search for all exec operations across the cluster in the past 24 hours to identify if this permission has already been abused

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2026-02-17
Modified: 2026-05-05
Authored by: panther-labs
Source ID
Upstream: rules/kubernetes_rules/k8s_role_pod_exec.yml
Type: rule
Version: 3
Data sources: Amazon.EKS.AuditAzure.MonitorActivityGCP.AuditLog

ATT&CK

TA0004TA0008 T1021 T1078.004